Iran, Russia, and North Korea Drive Surge in Illicit Cryptocurrency Activity

Iran’s Islamic Revolutionary Guard Corps (IRGC) has reportedly moved more than $2 billion through cryptocurrency transactions to evade international sanctions and support cybercriminal operations, according to blockchain analytics firm Chainalysis. The actual figure may be significantly higher, as the estimate only includes sanctions designations issued by the United States. Iran’s case highlights a broader global trend: the rapid growth of illicit cryptocurrency activity fueled by heavily sanctioned states such as Iran, Russia, and North Korea.

Data compiled by Chainalysis shows that crypto crime reached record levels in 2025, with illicit cryptocurrency transactions surging by 162% year over year to at least $154 billion. Sanctioned jurisdictions have increasingly turned to digital assets to bypass traditional financial systems, using blockchain networks to move, store, and launder funds outside conventional oversight mechanisms. In Iran, affiliated proxy groups and entities designated as terrorist organizations, including Hezbollah, Hamas, and the Houthis, have reportedly relied more heavily on cryptocurrencies to transfer and cash out funds.

Iran is not alone in driving this trend. Russia accounted for the largest share of illicit on-chain activity, a surge that accelerated after the launch of its ruble-pegged A7A5 stablecoin. Transactions associated with this token reached at least $93 billion, making it the primary contributor to an almost sevenfold increase in crypto activity among sanctioned entities. North Korea also remained a major threat actor, with hackers linked to the DPRK responsible for roughly $2 billion in stolen digital assets in 2025. These groups demonstrated growing sophistication in both cyberattacks and laundering techniques.

China added an unexpected dimension to the illicit crypto landscape. Chainalysis identified Chinese money laundering networks as a dominant force in 2025, offering services such as laundering-as-a-service and infrastructure support for scams, fraud, sanctions evasion, and terrorist financing. These networks have evolved into professionalized criminal enterprises supporting both cybercrime and physical crimes, including human trafficking and coercive violence.

While illicit transactions still represent a small fraction of total cryptocurrency activity, Chainalysis stressed that the scale, organization, and real-world impact of crypto-enabled crime have reached unprecedented levels, underscoring the urgent need to protect the integrity and security of the global crypto ecosystem.